This may be more of a question for your wife, but what is the practical consequence of a company violating it’s own privacy policy? What rights would a consumer/customer have against the company for such violations?

Will: well, the consumer would have a breach of contract claim, but damages are probably zilch. The FTC could go after the site under its Section 5 powers, and state attorneys general could do so under various unfair competition laws. Jane would be a better person to answer the tort questions, but my sense is that proving both harm and causation would be very difficult, and I don’t know of any successful suits along these lines. Consumers usually try some sort of ECPA / state wiretapping law claims as well, to no avail. I suppose my pessimistic answer is that there is no real recourse for consumers as individuals, unless they can get some regulator to take notice.